ASD Essentials
ASD's framework series, published 15 October 2026, that gives organisations a consistent approach to cyber security across technology environments. Each chapter uses the same three layers: principles, actions and domains. Current chapters cover enterprise IT, cloud and operational technology.
What it is. ASD describes the ASD Essentials series as a framework that provides organisations with a consistent approach to cyber security across different technology environments. The series is made up of environment-specific chapters. Each chapter applies the same underlying model while accounting for the threats, risks and operational considerations of the environment it covers.
Chapters
Current chapters address enterprise IT, cloud and operational technology (OT). The series is built so more environment-specific chapters can be added. An organisation may find one chapter is relevant, several apply to different parts of its environment, or a business function depends on assets covered by more than one chapter. ASD says there is no requirement to use every chapter or to apply relevant chapters in a set order. CyberStack has a page for the enterprise IT chapter; it does not yet have pages for the cloud and OT chapters.
Three layers
Principles describe the cyber security outcomes an organisation should achieve. They are drawn from the cyber security principles in ASD's Information security manual (ISM) and align with ASD's Modern defensible architecture. The intent of a principle stays the same between chapters, but not every principle applies to every chapter.
Actions describe what needs to be done to achieve those outcomes: the administrative and technical requirements used to implement a principle. They can differ between chapters, because ASD selects them by considering the relevant threat model, operational requirements and commercial viability. Where appropriate, actions are mapped to MITRE ATT&CK techniques to show the adversary behaviours they address.
Domains describe the business functions and assets to which the actions apply. A domain groups business functions and assets that share similar risks, meaning comparable exposure and consequence of compromise. It is a logical grouping, not a network or organisational boundary, so its assets can sit across different systems, locations, suppliers or parts of an organisation.
How they fit. The principle sets the intended outcome, the action says what to do, and the domain says where it applies. So an action is implemented in the context of a particular domain, not as a standalone requirement.
Relationship to the Essential Eight
ASD says it has evolved the Essential Eight into ASD Essentials for enterprise IT. It describes the Essential Eight as an important foundation for many of the controls the enterprise IT chapter requires. Essential Eight maturity level ratings do not automatically convert into ratings under the new chapter. See Transitioning from the Essential Eight.
Other publications in the series cover choosing a chapter, planning implementation (the Implementation planning guide), assessing posture and transitioning from the Essential Eight.
See also:
Fact source: ASD — What is the Essentials? (15 Oct 2026), ASD — ASD Essentials for enterprise IT, ASD — Transitioning from the Essential Eight (15 Oct 2026), ASD — Implementation planning guide.